Enabling OPC UA Server Access on SIMATIC PCS 7 ES-OS Single Station - WinCC OPC UA vs OpenPCS 7

To provide OPC UA access for external data analytics from a SIMATIC PCS 7 ES/OS Single Station, you do not necessarily need to install OpenPCS 7. The integrated SIMATIC WinCC OS runtime includes a native OPC UA Server (supporting DA, HDA, and AC profiles) that can be activated directly on the Single Station. Using the native WinCC OPC UA Server requires only a SIMATIC WinCC/Connectivity Pack server license (6AV6371-1DH07-...). OpenPCS 7 is an advanced gateway intended primarily for distributed multi-server architectures requiring transparent cross-server AS/OS tag and alarm consolidation, and it requires a dedicated OpenPCS 7 license package (6ES7658-0CX...). For a single ES/OS station, activating the native WinCC OPC UA Server with Connectivity Pack is the standard, lightweight solution.

Executive Summary

Modern digital transformation initiatives, Industrial Internet of Things (IIoT) platforms, and enterprise manufacturing intelligence systems frequently require exposing real-time process tags, historical trends, and alarm notifications from SIMATIC PCS 7 installations via OPC Unified Architecture (OPC UA). Engineers managing compact plant facilities running on a single PCS 7 ES/OS Single Station (often hosted on Windows Server with WinCC WebNavigator/WebClients) frequently ask whether adding OPC UA capability necessitates procuring, licensing, and configuring the heavyweight OpenPCS 7 software station, or if integrated native alternatives exist. This article evaluates the architectural and commercial distinctions between the native WinCC OPC UA Server and OpenPCS 7, details configuration requirements, and guides license procurement.

Architecture and Fundamental Mechanics

Architecture Comparison: Native WinCC OPC UA Server vs OpenPCS 7 Gateway:

Native WinCC OPC UA Server Architecture:
SIMATIC WinCC V7.4 / V7.5 (the SCADA core of PCS 7 V9.0 / V9.1) includes an integrated, high-performance OPC UA Server service (OPCUAServerWinCC.exe).
It natively exposes three primary OPC UA operational profiles directly from the local WinCC Runtime:
1. OPC UA Data Access (DA): Real-time read and write access to all internal and AS process tags.
2. OPC UA Historical Data Access (HDA): Historical queries against WinCC Tag Logging SQL database segments.
3. OPC UA Alarms & Conditions (AC): Real-time event notifications and historical queries from WinCC Alarm Logging.
The server runs in the process space of the ES/OS Single Station without requiring additional engineering objects in SIMATIC Manager.
Licensing Rules for Native WinCC OPC UA:
Activating the native WinCC OPC UA Server on an OS Single Station or OS Server requires a SIMATIC WinCC/Connectivity Pack server license (e.g. 6AV6371-1DH07-... for WinCC V7.5 / PCS 7 V9.0).
The license is installed locally on the station via Automation License Manager (ALM). Without this license, the OPC UA server runs in demo mode, triggering periodic licensing popups and client disconnections.
OpenPCS 7 Gateway Scope and Role:
OpenPCS 7 is an enterprise-level gateway designed for complex, distributed multi-server PCS 7 systems.
It runs as an independent station (typically on a separate OS Client PC) and connects across the terminal bus to multiple redundant OS Servers, aggregating tags, plant hierarchy paths (ISA-88 equipment models), and historical archives into a single unified OPC UA namespace.
OpenPCS 7 requires its own SIMATIC PCS 7 OpenPCS 7 software license package (6ES7658-0CX...).
For a single ES/OS Single Station, deploying OpenPCS 7 introduces redundant complexity and unnecessary licensing cost. The native WinCC OPC UA Server with Connectivity Pack provides identical tag access with significantly lower overhead.

Step-by-Step Implementation Procedure

Verify Licensing Prerequisites in ALM:
* Open Automation License Manager (ALM) on the ES/OS Single Station.
* Ensure that a valid license for 'SIMATIC WinCC Connectivity Pack' is present on local drive C: or D:.
* Note: The Connectivity Pack license covers WinCC OPC UA Server, WinCC OLE-DB Provider, and WinCC Connectivity Station functions.
Configure WinCC OPC UA Server Settings:
* Open WinCC Explorer on the ES/OS Single Station.
* In the WinCC navigation tree, expand 'OPC UA Server' or open Computer Properties -> Common Options.
* Right-click 'OPC UA Server' and select 'Open Configuration Dialog'.
* Define the TCP Communication Port (default: 4862 for DA/HDA, or 4880 for AC).
* Select the Supported Security Policies: Enable 'Basic256Sha256' (recommended for production) and disable 'None' in production environments.
* Configure User Authentication: Choose between Anonymous access (testing only) or Windows User Authentication (specifying authorized Windows user groups).
Digital Certificate Exchange and Trust Management:
* WinCC OPC UA generates a self-signed PKI certificate located in:
C:\ProgramData\Siemens\OPC\PKI\CA\certs
* Connect the external analytics client (e.g. UaExpert, Kepware, or Python OPC UA client) to the server URL: opc.tcp://<Server_IP_or_Host>:4862.
* The initial connection attempt will fail due to untrusted certificates.
* On the ES/OS station, browse to C:\ProgramData\Siemens\OPC\PKI\rejected.
* Move the incoming client certificate into C:\ProgramData\Siemens\OPC\PKI\trusted\certs.
* Copy the WinCC OPC UA server certificate to the client's trusted certificate store.
Configure Windows Defender Firewall:
* Open Windows Defender Firewall with Advanced Security.
* Create a new Inbound Rule: Protocol TCP, Local Port 4862 (and 4880 if using AC).
* Set action to 'Allow the connection' for Domain and Private network profiles.
Validate Connection and Tag Browsing:
* In your external OPC UA client, reconnect to opc.tcp://<Server_IP>:4862.
* Browse the address space under Root -> Objects -> WinCC.
* Confirm that process tags, setpoints, and historical archives are accessible and streaming real-time data.

Verification

Verify OPC UA Communication and License Compliance:
1. In the external OPC UA client, verify that connection status is 'Connected' with encrypted transport (e.g. Basic256Sha256 / SignAndEncrypt).
2. Read active process tags (such as motor run feedback or vessel level) and verify that values update with OPC Quality Code 'Good' (0x00000000).
3. In Automation License Manager, verify that 'WinCC Connectivity Pack' is actively consumed by the local WinCC process without license violation events in the ALM log.
4. Check Windows Event Viewer under Application Logs for 'OPCUAServerWinCC' to confirm clean startup without port binding errors.

Limitations and Operational Precautions

Operational Precautions and Resource Boundaries:
- Do not subject an ES/OS Single Station to excessively high polling rates from external analytics platforms. Polling hundreds of tags at sub-second intervals consumes CPU resources needed for real-time plant control and operator graphics; configure external polling intervals >= 1000 ms.
- Never leave OPC UA security set to 'None' on networks accessible from corporate IT or the Internet.
- Commercial Guardrail: Always validate final license quantities and exact MLFBs against the applicable Siemens catalog and authorized distributor quotation.

Engineer FAQ

What license is required to run the native WinCC OPC UA Server?

A SIMATIC WinCC/Connectivity Pack server license (order number series 6AV6371-1DH07-... for WinCC V7.5 / PCS 7 V9.0) is required on the station hosting the OPC UA server.

What is the difference between WinCC OPC UA and OpenPCS 7?

WinCC OPC UA provides local OPC UA DA, HDA, and AC server services for a single WinCC station. OpenPCS 7 is an advanced enterprise gateway that consolidates data, technological plant hierarchies, and archives across multiple distributed OS Servers.

Can I install OpenPCS 7 on an ES/OS Single Station?

Technically OpenPCS 7 can be installed on a Single Station, but it is neither recommended nor necessary. The native WinCC OPC UA Server provides the required tag access with significantly lower resource overhead and simpler licensing.

Which network ports does WinCC OPC UA use?

The default TCP port is 4862 for Data Access (DA) and Historical Data Access (HDA), and port 4880 for Alarms & Conditions (AC). These can be customized in the OPC UA configuration dialog.

Does WinCC OPC UA support Historical Alarm queries?

Yes. WinCC OPC UA Server supports OPC UA Alarms & Conditions (AC), enabling clients to subscribe to real-time alarms and query historical alarm archives from WinCC Alarm Logging.